Active Directory multiple simultaneous binds on same ldap connection

  • Thread starter Thread starter Pradnyesh Rane
  • Start date Start date
P

Pradnyesh Rane

Hi All,

We have a multithreaded application that may make simultaneous binds
[ldap_simple_bind] using the same ldap [not ADSI] connection to
authenticate users. We recently observed the following error in our
logs.

LdapErr: DSID-0C060454, comment: Only one outstanding bind per
connection allowed, data 0, v893

Has anybody seen this error before?

Is this documented somewhere? Is there a way to tune the number of
outstanding binds per connection.


I found the following article in the MS knowledge base that seems to
indicate that multiple binds on the same connection are allowed and
there was a bug fixed in that area.

http://support.microsoft.com/kb/289644/EN-US/


However I also found the following article in MSDN that states that
"Most LDAP calls are thread safe even when sharing the same connection
handle. The one exception is the LDAP bind. Do not attempt LDAP binds
simultaneously from two threads using the same connection."

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdir/html/BuildingADApps.asp



Can someone please clarify.

Thanks & Regards,
Pradnyesh Rane
 
Are you using Fast Concurrent Binding (LDAP_OPT_FAST_CONCURRENT_BIND)?

Joe K.
 
We have not set the fast bind option since we are running against Active
Directory 2000. The fast bind option is only available on Active
Directory.NET [2003].

Thanks & Regards,
Pradnyesh

Joe Kaplan (MVP - ADSI) said:
Are you using Fast Concurrent Binding (LDAP_OPT_FAST_CONCURRENT_BIND)?

Joe K.

Pradnyesh Rane said:
Hi All,

We have a multithreaded application that may make simultaneous binds
[ldap_simple_bind] using the same ldap [not ADSI] connection to
authenticate users. We recently observed the following error in our
logs.

LdapErr: DSID-0C060454, comment: Only one outstanding bind per
connection allowed, data 0, v893

Has anybody seen this error before?

Is this documented somewhere? Is there a way to tune the number of
outstanding binds per connection.


I found the following article in the MS knowledge base that seems to
indicate that multiple binds on the same connection are allowed and
there was a bug fixed in that area.

http://support.microsoft.com/kb/289644/EN-US/


However I also found the following article in MSDN that states that
"Most LDAP calls are thread safe even when sharing the same connection
handle. The one exception is the LDAP bind. Do not attempt LDAP binds
simultaneously from two threads using the same connection."
Click to expand...
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdir/ht
ml/BuildingADApps.asp
Can someone please clarify.

Thanks & Regards,
Pradnyesh Rane
Click to expand...
Click to expand...
 
My understanding is that you are only supposed to bind once per connection
unless you are using FCB under 2003. You might consider doing a new
connection for each bind or implementing some sort of pool if you are
worried about running out of TCP ports.

I'm not really the expert on this, so perhaps someone from MS will weigh in.

It sounds like you are trying to do authentication to AD. Have you
considered using the SSPI API instead? That's what its for.

Joe K.
Pradnyesh Rane said:
We have not set the fast bind option since we are running against Active
Directory 2000. The fast bind option is only available on Active
Directory.NET [2003].

Thanks & Regards,
Pradnyesh

Joe Kaplan (MVP - ADSI) said:
Are you using Fast Concurrent Binding (LDAP_OPT_FAST_CONCURRENT_BIND)?

Joe K.

Pradnyesh Rane said:
Hi All,

We have a multithreaded application that may make simultaneous binds
[ldap_simple_bind] using the same ldap [not ADSI] connection to
authenticate users. We recently observed the following error in our
logs.

LdapErr: DSID-0C060454, comment: Only one outstanding bind per
connection allowed, data 0, v893

Has anybody seen this error before?

Is this documented somewhere? Is there a way to tune the number of
outstanding binds per connection.


I found the following article in the MS knowledge base that seems to
indicate that multiple binds on the same connection are allowed and
there was a bug fixed in that area.

http://support.microsoft.com/kb/289644/EN-US/


However I also found the following article in MSDN that states that
"Most LDAP calls are thread safe even when sharing the same connection
handle. The one exception is the LDAP bind. Do not attempt LDAP binds
simultaneously from two threads using the same connection."
Click to expand...
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdir/ht
ml/BuildingADApps.asp
Can someone please clarify.

Thanks & Regards,
Pradnyesh Rane
Click to expand...
Click to expand...
Click to expand...
 
You can bind multiple times on a single connection, however, it is not thread
safe. All of the binds should be sent through a single thread in a consecutive
manner or multiple connections should be used with each sending binds
consecutively. You are changing the security context of the connection each time
you do it.

The LDAP_OPT_FAST_CONCURRENT_BIND supposedly will allow concurrent binds (hence
the name) however I haven't had a chance to try it out to say for sure; it is
interesting though that the online docs don't mention it as an exception to the
thread safeness of ldap_bind. Obviously if you are on Windows 2000 you can't use
that. It requires the Windows 2003 client and server sides.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net

My understanding is that you are only supposed to bind once per connection
unless you are using FCB under 2003. You might consider doing a new
connection for each bind or implementing some sort of pool if you are
worried about running out of TCP ports.

I'm not really the expert on this, so perhaps someone from MS will weigh in.

It sounds like you are trying to do authentication to AD. Have you
considered using the SSPI API instead? That's what its for.

Joe K.
We have not set the fast bind option since we are running against Active
Directory 2000. The fast bind option is only available on Active
Directory.NET [2003].

Thanks & Regards,
Pradnyesh

Are you using Fast Concurrent Binding (LDAP_OPT_FAST_CONCURRENT_BIND)?

Joe K.


Hi All,

We have a multithreaded application that may make simultaneous binds
[ldap_simple_bind] using the same ldap [not ADSI] connection to
authenticate users. We recently observed the following error in our
logs.

LdapErr: DSID-0C060454, comment: Only one outstanding bind per
connection allowed, data 0, v893

Has anybody seen this error before?

Is this documented somewhere? Is there a way to tune the number of
outstanding binds per connection.


I found the following article in the MS knowledge base that seems to
indicate that multiple binds on the same connection are allowed and
there was a bug fixed in that area.

http://support.microsoft.com/kb/289644/EN-US/


However I also found the following article in MSDN that states that
"Most LDAP calls are thread safe even when sharing the same connection
handle. The one exception is the LDAP bind. Do not attempt LDAP binds
simultaneously from two threads using the same connection."


http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdir/ht
ml/BuildingADApps.asp



Can someone please clarify.

Thanks & Regards,
Pradnyesh Rane
Click to expand...
Click to expand...
Click to expand...
 
Back
Top